Fix an Uninit read in DTLS
authorMatt Caswell <matt@openssl.org>
Wed, 28 Sep 2016 13:12:26 +0000 (14:12 +0100)
committerMatt Caswell <matt@openssl.org>
Thu, 29 Sep 2016 08:58:14 +0000 (09:58 +0100)
If we have a handshake fragment waiting then dtls1_read_bytes() was not
correctly setting the value of recvd_type, leading to an uninit read.

Reviewed-by: Rich Salz <rsalz@openssl.org>
ssl/record/rec_layer_d1.c

index 2455c2b..1d16319 100644 (file)
@@ -359,8 +359,10 @@ int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
     /*
      * check whether there's a handshake message (client hello?) waiting
      */
-    if ((ret = have_handshake_fragment(s, type, buf, len)))
+    if ((ret = have_handshake_fragment(s, type, buf, len))) {
+        *recvd_type = SSL3_RT_HANDSHAKE;
         return ret;
+    }
 
     /*
      * Now s->rlayer.d->handshake_fragment_len == 0 if